I am trying to understand a request I reverse engineered which is sent to a Daly BMS over BLE.

Those requests change the 'sleep after' in seconds of the BMS:

• For DDDD seconds: d2 06 00 8A DD DD 22 8A
• For FFFF seconds: d2 06 00 8A FF FF BA 33
• For EEEE seconds: d2 06 00 8A EE EE 76 6F
• For FFFE seconds: d2 06 00 8A FF FE 7B F3
• For 0000 seconds: d2 06 00 8A 00 00 BB 83

As you can see:

• The 'asleep' request start with the fixed: d2 06 00 8A prefix
• The data follows;
• The last two bytes is probably a CRC-16, which could be a custom one.

I'd like to build the last two digit by code.

Therefore, how can I get further? How can I understand how the two last bytes are built?

I am trying to understand a request I reverse engineered which is sent to a Daly BMS over BLE.

Those requests change the 'sleep after' in seconds of the BMS:

• For DDDD seconds: d2 06 00 8A DD DD 22 8A
• For FFFF seconds: d2 06 00 8A FF FF BA 33
• For EEEE seconds: d2 06 00 8A EE EE 76 6F
• For FFFE seconds: d2 06 00 8A FF FE 7B F3
• For 0000 seconds: d2 06 00 8A 00 00 BB 83

As you can see:

• The 'asleep' request start with the fixed: d2 06 00 8A prefix
• The data follows;
• The last two bytes is probably a CRC-16, which could be a custom one.

I'd like to build the last two digit by code.

Therefore, how can I get further? How can I understand how the two last bytes are built?

[UPDATED]

After the answer of @poncho, I share the implementation of the reverse CRC16 I wrote in Dart.

The dart pad is right there. Hope it helps.

I am trying to understand a request I reversed engineered to a Daly BMS over BLE.

Those requests change the 'sleep after' in seconds of the BMS:

• For DDDD seconds: d2 06 00 8A DD DD 22 8A
• For FFFF seconds: d2 06 00 8A FF FF BA 33
• For EEEE seconds: d2 06 00 8A EE EE 76 6F
• For FFFE seconds: d2 06 00 8A FF FE 7B F3
• For 0000 seconds: d2 06 00 8A 00 00 BB 83

As you can see:

• The 'asleep' request start with the fixed: d2 06 00 8A prefix
• The data follows;
• The last two bytes is probably a CRC-16, which could be a custom one.

I'd like to build the last two digit by code.

Therefore, how can I get further? How can I understand how the two last bytes are built?

I am trying to understand a request I reverse engineered which is sent to a Daly BMS over BLE.

Those requests change the 'sleep after' in seconds of the BMS:

• For DDDD seconds: d2 06 00 8A DD DD 22 8A
• For FFFF seconds: d2 06 00 8A FF FF BA 33
• For EEEE seconds: d2 06 00 8A EE EE 76 6F
• For FFFE seconds: d2 06 00 8A FF FE 7B F3
• For 0000 seconds: d2 06 00 8A 00 00 BB 83

As you can see:

• The 'asleep' request start with the fixed: d2 06 00 8A prefix
• The data follows;
• The last two bytes is probably a CRC-16, which could be a custom one.

I'd like to build the last two digit by code.

Therefore, how can I get further? How can I understand how the two last bytes are built?

I am trying to understand a request I reversed engineered to a Daly BMS over BLE.

Those requests change the 'sleep after' in seconds of the BMS:

• For DDDD seconds: d2 06 00 8A DD DD 22 8A
• For FFFF seconds: d2 06 00 8A FF FF BA 33
• For EEEE seconds: d2 06 00 8A EE EE 76 6F
• For FFFE seconds: d2 06 00 8A FF FE 7B F3

As you can see:

• The 'asleep' request start with the fixed: d2 06 00 8A prefix
• The data follows;
• The last two bytes is probably a CRC-16, which could be a custom one.

I'd like to build the last two digit by code.

Therefore, how can I get further? How can I understand how the two last bytes are built?

I am trying to understand a request I reversed engineered to a Daly BMS over BLE.

Those requests change the 'sleep after' in seconds of the BMS:

• For DDDD seconds: d2 06 00 8A DD DD 22 8A
• For FFFF seconds: d2 06 00 8A FF FF BA 33
• For EEEE seconds: d2 06 00 8A EE EE 76 6F
• For FFFE seconds: d2 06 00 8A FF FE 7B F3
• For 0000 seconds: d2 06 00 8A 00 00 BB 83

As you can see:

• The 'asleep' request start with the fixed: d2 06 00 8A prefix
• The data follows;
• The last two bytes is probably a CRC-16, which could be a custom one.

I'd like to build the last two digit by code.

Therefore, how can I get further? How can I understand how the two last bytes are built?